[ https://issues.apache.org/jira/browse/OFBIZ-6506?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jacques Le Roux updated OFBIZ-6506: ----------------------------------- Fix Version/s: (was: Release Branch 15.12) (was: 13.07.03) (was: Release Branch 14.12) 13.07.04 15.12.01 14.12.01 > XSS vulnerability in OFBiz forms and screens especially in display-entity > component > ----------------------------------------------------------------------------------- > > Key: OFBIZ-6506 > URL: https://issues.apache.org/jira/browse/OFBIZ-6506 > Project: OFBiz > Issue Type: Sub-task > Components: ALL COMPONENTS > Reporter: Lilian Iatco > Assignee: Jacques Le Roux > Labels: display, entity, form, ofbiz, screen, vulnerability, xss > Fix For: 14.12.01, 12.04.06, Upcoming Branch, 15.12.01, 13.07.04 > > Attachments: Tooltip no XSS issue.png > > > In Ofbiz form need to escape characters from description column in a > display-entity tag to avoid XSS attacks. > {code}<display-entity entity-name="Table" description="${description}" >{code} > I tried to use bsh, as following: > {code}<display-entity entity-name="Table" description="${bsh: > org.apache.commons.lang.StringEscapeUtils.escapeHtml("${description}")}">{code} > But I get this error: > {code} > Error rendering screen > [component://my/widget/CommonScreens.xml#GlobalDecorator]: > java.lang.IllegalStateException: This object has been flagged as immutable > (unchangeable), probably because it came from an Entity Engine cache. Cannot > set a value in an immutable entity object. > (This object has been flagged as immutable (unchangeable), probably because > it came from an Entity Engine cache. Cannot set a value in an immutable > entity object.) > {code} > PS: > Also you can see here a similar issue: > http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget -- This message was sent by Atlassian JIRA (v6.3.4#6332)